PolicyValidate

Libsemanage is the library responsible for building a kernel policy from policy modules. It has many features but one that is rarely mentioned is the policy validation hook. This page will show you how to make a basic validator and tell libsemanage to run it before allowing any policy updates.

First we'll write the validator. In this case we'll use sesearch to search for a rule between user_t and shadow_t. The purpose of this validator is to never allow a policy update that allows user_t to access shadow_t.

Make a file in /usr/local/bin/validate that contains the following (remember to chmod +x it or semodule will fail):

#!/bin/bash
# Usage: validate <policy file>
# The following searches for a file rule with user_t as the source and shadow_t as the target.
# If the output of sesearch has "Found", meaning matching rules were found, then grep will return 0
# otherwise it will return 1. This is actually the reverse of the logic we want, so we'll reverse it.
sesearch --allow -s user_t -t shadow_t -c file $1 | grep "Found" > /dev/null
if [ $? == 1 ]; then
exit 0
fi
exit 1